{"product_id":1029,"v_id":1029,"product_name":"netForensics 3.1.1 With Point Update 45149","certification_status":"Not Certified","certification_date":"2005-04-07T00:04:00Z","tech_type":"Enterprise Security Management","vendor_id":{"name":"netForensics, Inc.","website":"http://www.netforensics.com"},"vendor_poc":"Rajesh Vaidya","vendor_phone":"732.393.6000","vendor_email":"rajesh@netforensics.com","assigned_lab":{"cctl_name":"COACT, Inc. Labs"},"product_description":"<p>The netForensics V3.1.1 product is a Security Information Management (SIM) tool in that it collects and analyzes information from Security Devices deployed in a network and provides users with tools for viewing and evaluating the collective state of security. </p>\r\n<p>The netForensics product is produced by netForensics, Inc., 200 Metroplex Drive, Edison, NJ 08817. </p>\r\n<p>netForensics collects, normalizes, aggregates and correlates data from a number of third-party Security Devices. Users are able to monitor the collected data in real-time at differing levels of granularity and aggregation through pre-defined views. A wide-range of canned reports, queries, and drilldowns are provided to support forensics, analysis, and risk assessment. </p>\r\n<p>netForensics is comprised of the following components: </p>\r\n<ul>\r\n    <li><strong>nF SIM Desktop</strong> - is a Java application that is deployed with the Java Web-Start technology. The SIM Desktop is the primary interface for all administrators and analysts that use netForensics. </li>\r\n    <li><strong>nF Security Portal</strong> - is a Web application that provides system analysts and administrators with reports and other event review tools. </li>\r\n    <li><strong>nF Web Server</strong> - acts as the HTTP provider for nF SIM Desktop and nF Security Portal. </li>\r\n    <li><strong>nF Master</strong> - is responsible for collecting all of the SIM Data in an installation, maintaining state for analysis, updating real-time GUI components and applying display filters. The nF Master provides real-time data feeds, aggregated from multiple nF Engines, to the nF SIM Desktop clients. </li>\r\n    <li><strong>nF Provider</strong> - provides database services to all the registered netForensics components. These include reporting, administration, configuration, master data change (MDC) notification services, and access to the SIM Knowledgebase. </li>\r\n    <li><strong>nF Engine</strong> - performs analysis such as event aggregation before forwarding the SIM Data to the nF Master and saving it to the Database. </li>\r\n    <li><strong>nF Agents</strong> - collect, parse, and normalize the data from the various Security Devices or applications into a standard netForensics XML event schema. This standardized data is referred to as SIM Data, and once created it is pushed upstream to the next nF component.<br />\r\n    </li>\r\n</ul>","evaluation_configuration":null,"security_evaluation_summary":"<p>The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the netForensics TOE meets the security requirements contained in the Security Target. </p>\r\n<p>The criteria against which the netForensics TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.1. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 1.0. The COACT, Inc. CAFE Lab determined that the evaluation assurance level (EAL) for the netForensics TOE is EAL 2. The TOE, configured as specified in the installation guide, satisfies all of the security functional requirements stated in the Security Target. </p>\r\n<p>A Validator on behalf of the CCEVS Validation Body monitored the evaluation carried out by the COACT, Inc. CAFE Lab. The evaluation was completed in April, 2005. Results of the evaluation and associated validation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-05-0097, dated 7 April 2005) prepared by CCEVS. </p>\r\n<p><em style=\"COLOR: #f00\">The Validator notes that because this is a software-only product it is dependent upon the underlying platform for some protections. Furthermore, no capabilities to protect data transmissions between its components were evaluated. This is a concern when the product is deployed in a distributed configuration across a network as would be likely.<font color=\"#ff0000\"></font></em><font color=\"#ff0000\">&nbsp;</font> </p>","environmental_strengths":"<p>The netForensics TOE provides security audit, system analysts&rsquo; access policy, identification and authentication, and security information management features as they relate to enterprise security information management. </p>\r\n<p><strong>Security Audit</strong> - Actions taken by System Analysts generate audit records. </p>\r\n<p><strong>System Analysts&rsquo; Access Policy</strong> - The availability of SIM Data for monitoring and reporting depends on the mappings between System Analysts and Security Devices, because all SIM Data derives from Security Devices. </p>\r\n<p><strong>Identification and Authentication</strong> - netForensics supports two types of users. An Administrator who has complete control over all aspects of configuration and TSF Data, and a System Analyst whose access is limited to SIM Data from specific Security Devices. Both user interfaces, the nF SIM Desktop and the nF Security Portal, require users to identify and authenticate before accessing. </p>\r\n<p><strong>Administration</strong> - The netForensics administration user interface, accessible through the nF SIM Desktop, provides Administrators with the ability to view and centrally manage all users, System Analysts&rsquo; Access Rights, Device Integration Policies, and Event Analysis Policies. </p>\r\n<strong>Security Information Management</strong> - The nF Agents collect event messages from supported security devices and parse them into normalized SIM Data in accordance with a Device Integration Policy. The normalized events are passed to the nf Engine which performs aggregation analysis across all of the supported Security Devices in accordance with an Event Analysis Policy. The nf Master collects all of the SIM Data from the nF Engines and updates real-time GUI components. Users are able to monitor the collected data at differing levels of granularity and aggregation through pre-defined views.<!-- InstanceEndEditable -->","features":[]}